* 



WO 99/30458 PCT/US98/25824 

We claim: 

1 A method for producing an elliptic curve point multiplication product, O = eP, using 
an arbitrary integer e, a point P on an elliptic curve group G defined over a field F , where G <=F 
x F, comprising the steps of: 

constructing a set G ' ; 

constructing a mapping Tfrom G into the set G' constructing a mapping T } from G ' onto 
G, and constructing an operation © defined on G\ such that (a) given P gG,T ! ( T(P) ) = P , and 
(b)P+P= r'fP'® P?, where P' = T(P)\ 

producing an elliptic curve point multiplication product O by transforming the point P to 
the point P f using the mapping 7*, performing the operation © on the point P' to determine the 
point O' = eP\ transforming the point O' to the product Q using the mapping T l \ and 

using the product O in a cryptographic operation. 



;jj 2. The method of claim 1 wherein the set G, the set G', the mapping T y the operation 

;3 ©, and the mapping r ; are constructed such that given P h P 2 . . , P.v e G, where N is an integer, 

iesfe 

the computation of T l ( T(PJ © 77P 2 ; © © T(P N )) is more efficient than the computation of P, 

- P 2 - + Pv. 



3. The method of claim 1 wherein: 

the mapping 7 is constructed by selecting any element r of the field /% and defining 7 as T: 
( Xt y ) ^> ( x - r , y • r), where P = y) e G, and - is the multiplication operator in F; and 

the mapping T is constructed by defining T: (uy) -> fa - v • r~'j, where P' = fa,vj e 

G^ 
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4. 



The method of claim 3 wherein the field F is a member of GF(p). 



5. 



The method of claim 4 wherein the element r is selected as the smallest power of 2 



that is larger than p. 

6. The method of claim 4 wherein the element r is selected as the product of prime 
numbers. 

7. The method of claim 4 wherein the operation © is constructed such that the 
addition of two points in the set G'is given by: 

x 3 ' - L ' * L ' • r~ l - xi x /; and 
y 3 '=L'-(Xi'-x 3 0 -r 1 -y/. 

8. The method of claim 4 wherein the operation © is constructed such that the 
doubling of a point in the set G'is given by: 
(x,' 9 yiO®(x,\y,') = (xsM\ 

5 Z/= <T*/ /+ Xi'+Xi')'Xi'-r~* - a) .z'-f~ l \ 

x 3 '= U'L'-r~ l - x/- xi\ and 
y/= L''(x,'-x 3 0 -r"' ->>/'■ 
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9. 



The method of claim 4 wherein the Montgomery Algorithm in GF(p) is utilized to 



perform the operation © on the point P f to determine the point O 



10. The method of claim 3 wherein the field F is a member of GF(2 ). 

1 1 . The method of claim 10, wherein the operation © is constructed such that the 
addition of two points in the set G'is given by: 



x 3 ' = (L'-L'-f 1 ) + Z/+ x/'tx/^: and 
y 3 '=(L'-(x,'+x 3 0 -r' 1 ) + x 3 '+ y,'. 

12. The method of claim 10, wherein the operation © is constructed such that the 
doubling of a point is given by: 
(x/'yi!) ®'(xi',y t T= 

■ xj'^X/'-x/t-' + (z'-z'-r' 1 ) b -r- 7 ,and 
y 3 ' = x/ -x/ -T 1 + (xi'+yi'-z'-r- 1 ) -Xj'-r"' + x 3 '. 

13. The method of claim 10 wherein the element r is selected as x* mod n(x), where 
n(x) is the irreducible polynomial generating the field GF(2 k ). 



(x 3 ',y 3 9 - (xi'jiO® (x 3 :y 2 % 



14. The method of claim 10 wherein the Montgomery Algorithm in GF(2 k ) is utilized 
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to perform the operation © on the point P' to determine the point O' =■- e P f . 

1 5. The method of claim 1 wherein the step of performing the operation © on the 
point P f utilizes a binary method. 

16. The method of claim 1 wherein the step of performing the operation © on the 
point P' utilizes an M-ary method. 

17. The method of claim 1 wherein the elements of sets G and G' are implemented 
using Projective Coordinates. 

18. A method for optimizing the calculation of an expression / ^ f(x i% *i . x n), 
wherein the expression /is comprised of a finite number of arbitrary field operations over any 
finite field 7\ and x ; , x, , .... x„ are all elements of F, comprising the steps of: 

selecting an element r, a constant, from the field F\ 

transforming the expression / =f(xj x ; , xj to the/' ^f'(x, x/, .... x^ by 



replacing all occurrences of x in the expression / with x \ giving/, where x 



denotes a variable or constant of / ; 



replacing all occurrences of x -y in the expression/ with x®y t giving/ 



where x and^ denote subexpressions of/ ; 
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replacing all occurrences of 



x' 1 in the expression f 2 with x 1 • r , giving/;, 



where x denotes a subexpression of /; 



replacing all occurrences of x ® y in the expression/^ with x • y • r 1 , 



giving/;, where x and y denote subexpressions of/;; and 
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replacing all occurrences of x ' in the expression/4 with x • r; giving/ \ 

where x denotes a primed variable or primed constant in/*; 

determining/=/ / • m~ and 

using /' * rrf 1 to calculate /in a cryptographic operation. 

19. The method of claim 1 8 wherein each instance of x' -y ' ■ rrf 1 is computed using the 
Montgomery Algorithm when the set F is a member of GF(p) 

20. The method of claim 18 wherein each instance of x' >y' • nf 1 is computed using the 
Montgomery Algorithm in GF(2 k ) when the set F is a member of GF(2 k ). 

21. A method for producing an elliptic curve point addition product, Q = P - P, using 
a point P on an elliptic curve group G defined over a field F t where GcFxF, comprising the 

steps of: 

constructing a set G ' ; 

constructing a mapping Tfrom G into the set G\ constructing a mapping T l from G'onto 
G, and constructing an operation ® defined on G\ such that (a) given P eG y T l ( T(P) ) = P, and 
(b)P+P = r'(P'®P% where 7yP;; and 

producing an elliptic curve point addition product O by transforming the point P to the 
point P' using the mapping T % performing the operation ® on the point P' and the point P' to 
0 determine the point Q\ transforming the point O' to the product Q using the mapping T l \ and 
using the product O in a cryptographic operation. 



22. A method for producing an elliptic curve point addition product, O P S, using 
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points F and 5 on an elliptic curve group G defined over a field F, where G <=F x F, comprising 

the steps of: 

constructing a set G ' ; 

5 constructing a mapping Ffrom G into the set G' constructing a mapping F~ y from G'onto 

G, and constructing an operation 0 defined on G\ such that (a) given P e G, F~Y W ^ = ^ and 
(b)F-S = r'(P f ®S0, where F' = FfF; andS' = 7^; and 

producing an elliptic curve point addition product Q by transforming the point P to the 
point P f using the mapping F, by transforming the point 5 to the point S' using the mapping F, 
= n 10 performing the operation © on the point P f and the point 5" to determine the point Q\ 
transforming the point O' to the product O using the mapping F 7 ; and 
using the product O in a cryptographic operation. 
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23. Apparatus for producing an elliptic curve point multiplication product, Q - eP, 
using an arbitrary integer e, a point P on an elliptic curve group G defined over a field F. where G 
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means for constructing a set G ' ; 
5 means for constructing a mapping T from G into the set G f , constructing a mapping T l 

from G ' onto G, and constructing an operation © defined on G '; such that (a) given P e G, T l ( 
T(P) ) = F, and (b) F+F = r'fP'© F^ 5 where F' = F(F^I; and 

means for producing an elliptic curve point multiplication product O by transforming the 
point F to the point F' using the mapping T 9 performing the operation © on the point F' to 
1 0 determine the point Q'=eP', transforming the point O ' to the product O using the mapping 
r ; ; and 

means for using the product O in a cryptographic operation. 
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